two factor is something you have and something you know
for rsa tokens, the something you have (rsa token) provides you with a number, adn the something you know (your pin) extends that to provide a 2 part answer
for yubikey, its a pin and the yubikey
for iphone to reset your icloud account, you need the passcode for the phone and the ability to receive apple's device specific message to that specific phone
you're required to know something, and physically possess something